BPGW/ Docs/ Callbacks
Payment Flow

Callbacks

The final and most critical step in payment confirmation. Redirect success is never trusted — the plugin verifies payment server-to-server before marking any order as paid.

bKash callback

Endpoint registered in your bKash merchant dashboard:

GET ?wc-api=bpgw_bkash_callback

Typical return query from bKash after payment:

?wc-api=bpgw_bkash_callback
  &order_id=16
  &paymentID=TR0011ABC...
  &status=success
  &signature=...
  &apiVersion=1.2.0-beta

What the handler does:

  • Reads and sanitizes order_id, paymentID, status, signature, apiVersion
  • Confirms the order exists and belongs to bKash payment method
  • Calls bKash execute API to verify the payment
  • Marks order paid only when bKash verification returns a success code

SSLCommerz callback

Endpoint registered in your SSLCommerz dashboard (Success, Fail, and Cancel all point here):

POST ?wc-api=bpgw_sslcommerz_callback

What the handler does:

  • Reads order_id and tran_id from the POST body
  • Validates the transaction via SSLCommerz merchant transaction validation API
  • Completes the order only when status is VALID or VALIDATED
  • Cancels or holds the order on any other status response

Security principle

Both gateways redirect the customer back to your site after payment. This redirect alone is never sufficient to confirm a payment — it can be spoofed or arrive with a tampered status. BPGW always performs a secondary server-to-server API call to the gateway to independently verify the transaction before any order status change.